Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] `component_master_add_with_match()` blindly dereferences the `match` parameter without checking if it is an `ERR_PTR`, leading to a kernel panic. -- --- Patch [1]: [PATCH] component: Release match data on add failure --- commit c4097bf086b1fb54cc12acc0308e520336458718 Author: Ruoyu Wang <[email protected]> component: Release match data on add failure component_match_add_release() accepts a release callback so callers can transfer ownership of resources held by the match data. However, __component_match_add() returns without invoking that callback when the match is already an error pointer or when allocating the match or its array fails. > diff --git a/drivers/base/component.c b/drivers/base/component.c > index 655d68deb590c..2b455d7499926 100644 > --- a/drivers/base/component.c > +++ b/drivers/base/component.c > @@ -388,14 +388,14 @@ static void __component_match_add(struct device *parent, > struct component_match *match = *matchptr; > > if (IS_ERR(match)) > - return; > + goto err_release; > > if (!match) { > match = devres_alloc(devm_component_match_release, > sizeof(*match), GFP_KERNEL); > if (!match) { > *matchptr = ERR_PTR(-ENOMEM); > - return; > + goto err_release; [Severity: High] This is a pre-existing issue, but if __component_match_add() fails here and sets *matchptr to ERR_PTR(-ENOMEM), could this result in a kernel panic later? Callers such as drm_of_component_probe() in drivers/gpu/drm/drm_of.c often pass the resulting match pointer directly to component_master_add_with_match() without checking IS_ERR(match): drivers/gpu/drm/drm_of.c:drm_of_component_probe() { ... return component_master_add_with_match(dev, m_ops, match); } component_master_add_with_match() then appears to blindly dereference the pointer: drivers/base/component.c:component_master_add_with_match() { ... ret = component_match_realloc(match, match->num); ... } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
